(n, e) RSA public key
c ciphertext representative, an integer between 0 and n-1 C ciphertext, an octet string
d private exponent
dP p’s exponent, a positive integer such that:
e(dP)\equiv 1 (mod(p-1))
dQ q’s exponent, a positive integer such that:
e(dQ)\equiv 1 (mod(q-1)) e public exponent
EM encoded message, an octet string
emLen intended length in octets of an encoded message H hash value, an output of Hash
Hash hash function
hLen output length in octets of hash function Hash K RSA private key
k length in octets of the modulus l intended length of octet string lcm(.,.) least common multiple of two nonnegative integers
m message representative, an integer between 0 and n-1
M message, an octet string MGF mask generation function n modulus
P encoding parameters, an octet string p,q prime factors of the modulus
qInv CRT coefficient, a positive integer less than p such: q(qInv)\equiv 1 (mod p) s signature representative, an integer between 0 and n-1
S signature, an octet string x a nonnegative integer
X an octet string corresponding to x
\xor bitwise exclusive-or of two octet strings \lambda(n) lcm(p-1, q-1), where n = pq
|| concatenation operator ||.|| octet length operator 3. Key types
Two key types are employed in the primitives and schemes defined in this document: RSA public key and RSA private key. Together, an RSA public key and an RSA private key form an RSA key pair.
3.1 RSA public key
For the purposes of this document, an RSA public key consists of two components:
n, the modulus, a nonnegative integer
e, the public exponent, a nonnegative integer
In a valid RSA public key, the modulus n is a product of two odd primes p and q, and the public exponent e is an integer between 3 and n-1 satisfying gcd (e, \lambda(n)) = 1, where \lambda(n) = lcm 1,q-1). A recommended syntax for interchanging RSA public keys between implementations is given in Section 11.1.1; an
implementation’s internal representation may differ.
3.2 RSA private key
For the purposes of this document, an RSA private key may have either of two representations.
1. The first representation consists of the pair (n, d), where the components have the following meanings:
n, the modulus, a nonnegative integer
d, the private exponent, a nonnegative integer
2. The second representation consists of a quintuple (p, q, dP, dQ, qInv), where the components have the following meanings:
p, the first factor, a nonnegative integer q, the second factor, a nonnegative integer
dP, the first factor’s exponent, a nonnegative integer dQ, the second factor’s exponent, a nonnegative integer qInv, the CRT coefficient, a nonnegative integer
In a valid RSA private key with the first representation, the modulus n is the same as in the corresponding public key and is the product of two odd primes p and q, and the private exponent d is a positive
integer less than n satisfying:
ed \equiv 1 (mod \lambda(n))
where e is the corresponding public exponent and \lambda(n) is as defined above.
In a valid RSA private key with the second representation, the two factors p and q are the prime factors of the modulus n, the exponents dP and dQ are positive integers less than p and q respectively
satisfying
e(dP)\equiv 1(mod(p-1)) e(dQ)\equiv 1(mod(q-1)),
and the CRT coefficient qInv is a positive integer less than p satisfying:
q(qInv)\equiv 1 (mod p).
A recommended syntax for interchanging RSA private keys between
implementations, which includes components from both representations, is given in Section 11.1.2; an implementation’s internal
representation may differ.
4. Data conversion primitives
Two data conversion primitives are employed in the schemes defined in this document:
I2OSP: Integer-to-Octet-String primitive OS2IP: Octet-String-to-Integer primitive
For the purposes of this document, and consistent with ASN.1 syntax, an octet string is an ordered sequence of octets (eight-bit bytes). The sequence is indexed from first (conventionally, leftmost) to last
(rightmost). For purposes of conversion to and from integers, the first octet is considered the most significant in the following conversion primitives
4.1 I2OSP
I2OSP converts a nonnegative integer to an octet string of a specified length.
I2OSP (x, l)
Input:
x nonnegative integer to be converted
l intended length of the resulting octet string Output:
X corresponding octet string of length l; or "integer too large"
Steps:
1. If x>=256^l, output "integer too large" and stop.
2. Write the integer x in its unique l-digit representation base 256:
x = x_{l-1}256^{l-1} + x_{l-2}256^{l-2} +... + x_1 256 + x_0
where 0 <= x_i < 256 (note that one or more leading digits will be zero if x < 256^{l-1}).
3. Let the octet X_i have the value x_{l-i} for 1 <= i <= l. Output the octet string:
X = X_1 X_2 ... X_l.
4.2 OS2IP
OS2IP converts an octet string to a nonnegative integer.
OS2IP (X) Input:
X octet string to be converted Output:
x corresponding nonnegative integer Steps:
1. Let X_1 X_2 ... X_l be the octets of X from first to last, and let x{l-i} have value X_i for 1<= i <= l.
2. Let x = x{l-1} 256^{l-1} + x_{l-2} 256^{l-2} +...+ x_1 256 + x_0.
3. Output x.
5. Cryptographic primitives
Cryptographic primitives are basic mathematical operations on which cryptographic schemes can be built. They are intended for
implementation in hardware or as software modules, and are not intended to provide security apart from a scheme.
Four types of primitive are specified in this document, organized in pairs: encryption and decryption; and signature and verification.
The specifications of the primitives assume that certain conditions are met by the inputs, in particular that public and private keys are valid.
5.1 Encryption and decryption primitives
An encryption primitive produces a ciphertext representative from a message representative under the control of a public key, and a decryption primitive recovers the message representative from the ciphertext representative under the control of the corresponding private key.
One pair of encryption and decryption primitives is employed in the encryption schemes defined in this document and is specified here:
RSAEP/RSADP. RSAEP and RSADP involve the same mathematical operation, with different keys as input.
The primitives defined here are the same as in the draft IEEE P1363 and are compatible with PKCS #1 v1.5.
The main mathematical operation in each primitive is exponentiation.
5.1.1 RSAEP
RSAEP((n, e), m) Input:
(n, e) RSA public key
m message representative, an integer between 0 and n-1 Output:
c ciphertext representative, an integer between 0 and n-1;
or "message representative out of range"
Assumptions: public key (n, e) is valid Steps:
1. If the message representative m is not between 0 and n-1, output message representative out of range and stop.
2. Let c = m^e mod n.
3. Output c.
5.1.2 RSADP RSADP (K, c) Input:
K RSA private key, where K has one of the following forms -a pair (n, d)
-a quintuple (p, q, dP, dQ, qInv)
c ciphertext representative, an integer between 0 and n-1 Output:
m message representative, an integer between 0 and n-1; or "ciphertext representative out of range"
Assumptions: private key K is valid Steps:
1. If the ciphertext representative c is not between 0 and n-1, output "ciphertext representative out of range" and stop.
2. If the first form (n, d) of K is used:
2.1 Let m = c^d mod n. Else, if the second form (p, q, dP, dQ, qInv) of K is used:
2.2 Let m_1 = c^dP mod p.
2.3 Let m_2 = c^dQ mod q.
2.4 Let h = qInv ( m_1 - m_2 ) mod p.
2.5 Let m = m_2 + hq.
3. Output m.
5.2 Signature and verification primitives
A signature primitive produces a signature representative from a message representative under the control of a private key, and a verification primitive recovers the message representative from the signature representative under the control of the corresponding public key. One pair of signature and verification primitives is employed in the signature schemes defined in this document and is specified here: RSASP1/RSAVP1.
The primitives defined here are the same as in the draft IEEE P1363 and are compatible with PKCS #1 v1.5.
The main mathematical operation in each primitive is exponentiation, as in the encryption and decryption primitives of Section 5.1. RSASP1 and RSAVP1 are the same as RSADP and RSAEP except for the names of their input and output arguments; they are distinguished as they are intended for different purposes.
5.2.1 RSASP1 RSASP1 (K, m) Input:
K RSA private key, where K has one of the following forms:
-a pair (n, d)
-a quintuple (p, q, dP, dQ, qInv)
m message representative, an integer between 0 and n-1 Output:
s signature representative, an integer between 0 and n-1, or "message representative out of range"
Assumptions:
private key K is valid Steps:
1. If the message representative m is not between 0 and n-1, output "message representative out of range" and stop.
2. If the first form (n, d) of K is used:
2.1 Let s = m^d mod n. Else, if the second form (p, q, dP, dQ, qInv) of K is used:
2.2 Let s_1 = m^dP mod p.
2.3 Let s_2 = m^dQ mod q.
2.4 Let h = qInv ( s_1 - s_2 ) mod p.
2.5 Let s = s_2 + hq.
3. Output S.
5.2.2 RSAVP1
RSAVP1 ((n, e), s) Input:
(n, e) RSA public key
s signature representative, an integer between 0 and n-1 Output:
m message representative, an integer between 0 and n-1;
or "invalid"
Assumptions:
public key (n, e) is valid Steps:
1. If the signature representative s is not between 0 and n-1, output "invalid" and stop.
2. Let m = s^e mod n.
3. Output m.
6. Overview of schemes
A scheme combines cryptographic primitives and other techniques to achieve a particular security goal. Two types of scheme are specified in this document: encryption schemes and signature schemes with
appendix.
The schemes specified in this document are limited in scope in that their operations consist only of steps to process data with a key, and do not include steps for obtaining or validating the key. Thus, in addition to the scheme operations, an application will typically include key management operations by which parties may select public and private keys for a scheme operation. The specific additional operations and other details are outside the scope of this document.
As was the case for the cryptographic primitives (Section 5), the specifications of scheme operations assume that certain conditions are met by the inputs, in particular that public and private keys are valid. The behavior of an implementation is thus unspecified when a key is invalid. The impact of such unspecified behavior depends on the application. Possible means of addressing key validation include explicit key validation by the application; key validation within the public-key infrastructure; and assignment of liability for operations performed with an invalid key to the party who generated the key.
7. Encryption schemes
An encryption scheme consists of an encryption operation and a decryption operation, where the encryption operation produces a ciphertext from a message with a recipient’s public key, and the decryption operation recovers the message from the ciphertext with the recipient’s corresponding private key.
An encryption scheme can be employed in a variety of applications. A typical application is a key establishment protocol, where the
message contains key material to be delivered confidentially from one party to another. For instance, PKCS #7 [21] employs such a protocol to deliver a content-encryption key from a sender to a recipient; the encryption schemes defined here would be suitable key-encryption algorithms in that context.
Two encryption schemes are specified in this document: RSAES-OAEP and RSAES-PKCS1-v1_5. RSAES-OAEP is recommended for new applications;
RSAES-PKCS1-v1_5 is included only for compatibility with existing applications, and is not recommended for new applications.
The encryption schemes given here follow a general model similar to that employed in IEEE P1363, by combining encryption and decryption primitives with an encoding method for encryption. The encryption operations apply a message encoding operation to a message to produce an encoded message, which is then converted to an integer message representative. An encryption primitive is applied to the message representative to produce the ciphertext. Reversing this, the
decryption operations apply a decryption primitive to the ciphertext to recover a message representative, which is then converted to an octet string encoded message. A message decoding operation is applied to the encoded message to recover the message and verify the
correctness of the decryption.
7.1 RSAES-OAEP
RSAES-OAEP combines the RSAEP and RSADP primitives (Sections 5.1.1 and 5.1.2) with the EME-OAEP encoding method (Section 9.1.1) EME-OAEP is based on the method found in [2]. It is compatible with the IFES scheme defined in the draft P1363 where the encryption and decryption primitives are IFEP-RSA and IFDP-RSA and the message encoding method is EME-OAEP. RSAES-OAEP can operate on messages of length up to 2hLen octets, where hLen is the length of the hash function output for EME-OAEP and k is the length in octets of the recipient’s RSA modulus. Assuming that the hash function in EME-OAEP has appropriate properties, and the key size is sufficiently large, RSAEP-OAEP
provides "plaintext-aware encryption," meaning that it is
computationally infeasible to obtain full or partial information about a message from a ciphertext, and computationally infeasible to generate a valid ciphertext without knowing the corresponding
message. Therefore, a chosen-ciphertext attack is ineffective against a plaintext-aware encryption scheme such as RSAES-OAEP.
Both the encryption and the decryption operations of RSAES-OAEP take the value of the parameter string P as input. In this version of PKCS #1, P is an octet string that is specified explicitly. See Section 11.2.1 for the relevant ASN.1 syntax. We briefly note that to receive the full security benefit of RSAES-OAEP, it should not be used in a protocol involving RSAES-PKCS1-v1_5. It is possible that in a
protocol on which both encryption schemes are present, an adaptive chosen ciphertext attack such as [4] would be useful.
Both the encryption and the decryption operations of RSAES-OAEP take the value of the parameter string P as input. In this version of PKCS #1, P is an octet string that is specified explicitly. See Section 11.2.1 for the relevant ASN.1 syntax.
7.1.1 Encryption operation
RSAES-OAEP-ENCRYPT ((n, e), M, P) Input:
(n, e) recipient’s RSA public key
M message to be encrypted, an octet string of length at most k-2-2hLen, where k is the length in octets of the modulus n and hLen is the length in octets of the hash function output for EME-OAEP
P encoding parameters, an octet string that may be empty
Output:
C ciphertext, an octet string of length k; or "message too long"
Assumptions: public key (n, e) is valid Steps:
1. Apply the EME-OAEP encoding operation (Section 9.1.1.2) to the message M and the encoding parameters P to produce an encoded message EM of length k-1 octets:
EM = EME-OAEP-ENCODE (M, P, k-1)
If the encoding operation outputs "message too long," then output "message too long" and stop.
2. Convert the encoded message EM to an integer message representative m: m = OS2IP (EM)
3. Apply the RSAEP encryption primitive (Section 5.1.1) to the public key (n, e) and the message representative m to produce an integer ciphertext representative c:
c = RSAEP ((n, e), m)
4. Convert the ciphertext representative c to a ciphertext C of length k octets: C = I2OSP (c, k)
5. Output the ciphertext C.
7.1.2 Decryption operation RSAES-OAEP-DECRYPT (K, C, P) Input:
K recipient’s RSA private key
C ciphertext to be decrypted, an octet string of length k, where k is the length in octets of the modulus n P encoding parameters, an octet string that may be empty Output:
M message, an octet string of length at most k-2-2hLen, where hLen is the length in octets of the hash
function output for EME-OAEP; or "decryption error"
Steps:
1. If the length of the ciphertext C is not k octets, output "decryption error" and stop.
2. Convert the ciphertext C to an integer ciphertext representative c: c = OS2IP (C).
3. Apply the RSADP decryption primitive (Section 5.1.2) to the private key K and the ciphertext representative c to produce an integer message representative m:
m = RSADP (K, c)
If RSADP outputs "ciphertext out of range," then output "decryption error" and stop.
4. Convert the message representative m to an encoded message EM of length k-1 octets: EM = I2OSP (m, k-1)
If I2OSP outputs "integer too large," then output "decryption error"
and stop.
5. Apply the EME-OAEP decoding operation to the encoded message EM and the encoding parameters P to recover a message M:
M = EME-OAEP-DECODE (EM, P)
If the decoding operation outputs "decoding error," then output "decryption error" and stop.
6. Output the message M.
Note. It is important that the error messages output in steps 4 and 5 be the same, otherwise an adversary may be able to extract useful information from the type of error message received. Error message information is used to mount a chosen-ciphertext attack on PKCS #1 v1.5 encrypted messages in [4].
7.2 RSAES-PKCS1-v1_5
RSAES-PKCS1-v1_5 combines the RSAEP and RSADP primitives with the EME-PKCS1-v1_5 encoding method. It is the same as the encryption scheme in PKCS #1 v1.5. RSAES-PKCS1-v1_5 can operate on messages of length up to k-11 octets, although care should be taken to avoid certain attacks on low-exponent RSA due to Coppersmith, et al. when long messages are encrypted (see the third bullet in the notes below and [7]).
RSAES-PKCS1-v1_5 does not provide "plaintext aware" encryption. In particular, it is possible to generate valid ciphertexts without knowing the corresponding plaintexts, with a reasonable probability of success. This ability can be exploited in a chosen ciphertext attack as shown in [4]. Therefore, if RSAES-PKCS1-v1_5 is to be used, certain easily implemented countermeasures should be taken to thwart the attack found in [4]. The addition of structure to the data to be encoded, rigorous checking of PKCS #1 v1.5 conformance and other redundancy in decrypted messages, and the consolidation of error messages in a client-server protocol based on PKCS #1 v1.5 can all be effective countermeasures and don’t involve changes to a PKCS #1 v1.5-based protocol. These and other countermeasures are discussed in [5].
Notes. The following passages describe some security recommendations pertaining to the use of RSAES-PKCS1-v1_5. Recommendations from version 1.5 of this document are included as well as new
recommendations motivated by cryptanalytic advances made in the intervening years.
-It is recommended that the pseudorandom octets in EME-PKCS1-v1_5 be generated independently for each encryption process, especially if the same data is input to more than one encryption process. Hastad’s results [13] are one motivation for this recommendation.
-The padding string PS in EME-PKCS1-v1_5 is at least eight octets long, which is a security condition for public-key operations that prevents an attacker from recovering data by trying all possible encryption blocks.
-The pseudorandom octets can also help thwart an attack due to Coppersmith et al. [7] when the size of the message to be encrypted is kept small. The attack works on low-exponent RSA when similar messages are encrypted with the same public key. More specifically, in one flavor of the attack, when two inputs to RSAEP agree on a large fraction of bits (8/9) and low-exponent RSA (e = 3) is used to encrypt both of them, it may be possible to recover both inputs with the attack. Another flavor of the attack is successful in decrypting a single ciphertext when a large fraction (2/3) of the input to RSAEP is already known. For typical applications, the message to be
encrypted is short (e.g., a 128-bit symmetric key) so not enough information will be known or common between two messages to enable the attack. However, if a long message is encrypted, or if part of a message is known, then the attack may be a concern. In any case, the RSAEP-OAEP scheme overcomes the attack.
7.2.1 Encryption operation
RSAES-PKCS1-V1_5-ENCRYPT ((n, e), M) Input:
(n, e) recipient’s RSA public key
M message to be encrypted, an octet string of length at most k-11 octets, where k is the length in octets of the modulus n
Output:
C ciphertext, an octet string of length k; or "message too long"
Steps:
1. Apply the EME-PKCS1-v1_5 encoding operation (Section 9.1.2.1) to the message M to produce an encoded message EM of length k-1 octets:
EM = EME-PKCS1-V1_5-ENCODE (M, k-1)
If the encoding operation outputs "message too long," then output "message too long" and stop.
2. Convert the encoded message EM to an integer message representative m: m = OS2IP (EM)
3. Apply the RSAEP encryption primitive (Section 5.1.1) to the public key (n, e) and the message representative m to produce an integer ciphertext representative c: c = RSAEP ((n, e), m)
4. Convert the ciphertext representative c to a ciphertext C of length k octets: C = I2OSP (c, k)
5. Output the ciphertext C.
7.2.2 Decryption operation
RSAES-PKCS1-V1_5-DECRYPT (K, C) Input:
K recipient’s RSA private key
C ciphertext to be decrypted, an octet string of length k, where k is the length in octets of the modulus n
Output:
M message, an octet string of length at most k-11; or "decryption error"
Steps:
1. If the length of the ciphertext C is not k octets, output "decryption error" and stop.
2. Convert the ciphertext C to an integer ciphertext representative c: c = OS2IP (C).
3. Apply the RSADP decryption primitive to the private key (n, d) and
3. Apply the RSADP decryption primitive to the private key (n, d) and